Junrar
Monthly
Denial of service in Junrar before 7.6.1 allows unauthenticated remote attackers to exhaust CPU and archive-processing worker capacity by supplying a crafted RAR4 archive. The archive drives the built-in RAR virtual machine into an infinite loop via a VM_JMP instruction targeting an address at or beyond the prepared program's codeSize; because the VM cannot execute native code, the supported impact is availability loss rather than code execution. No public exploit code or confirmed active exploitation has been identified, and the flaw is fixed in version 7.6.1.
Path traversal in Junrar library versions prior to 7.5.10 allows remote attackers to write arbitrary files into sibling directories by extracting a crafted RAR archive, enabling unauthorized file creation and potential code injection. The vulnerability requires high attack complexity (AC:H) but no authentication or user interaction, affecting any Java application using vulnerable Junrar versions to process untrusted RAR files. Vendor-released patch: version 7.5.10.
Path traversal in junrar (the open source Java RAR archive library) prior to version 7.6.1 lets an attacker-supplied RAR archive cause LocalFolderExtractor to create directories outside the intended extraction root. The flaw exists because createFile() validates only the final canonical file path while makeFile() creates intermediate path segments with unchecked mkdir() calls, so a crafted entry whose final path resolves inside the destination can still spawn directories elsewhere - a specificity that is why the assessed vector carries AC:H. Impact is confined to directory creation and file-versus-directory squatting that can make later security-sensitive writes fail; there is no arbitrary file-content write and no confidentiality loss, unauthenticated remote attackers are the relevant threat model only when a host application extracts untrusted archives through this specific extractor, and no public exploit code has been identified at time of analysis. This is a genuinely low-priority issue, and the vendor's CVSS of 3.7 reflects that honestly rather than inflating it.
Junrar versions prior to 7.5.8 contain a path traversal vulnerability in LocalFolderExtractor that allows attackers to write arbitrary files to the filesystem when processing malicious RAR archives on Linux/Unix systems. Public exploit code exists for this vulnerability, which can facilitate remote code execution through file overwrite attacks such as modifying shell profiles or cron jobs. Users should upgrade to version 7.5.8 or later to remediate this issue.
Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Denial of service in Junrar before 7.6.1 allows unauthenticated remote attackers to exhaust CPU and archive-processing worker capacity by supplying a crafted RAR4 archive. The archive drives the built-in RAR virtual machine into an infinite loop via a VM_JMP instruction targeting an address at or beyond the prepared program's codeSize; because the VM cannot execute native code, the supported impact is availability loss rather than code execution. No public exploit code or confirmed active exploitation has been identified, and the flaw is fixed in version 7.6.1.
Path traversal in Junrar library versions prior to 7.5.10 allows remote attackers to write arbitrary files into sibling directories by extracting a crafted RAR archive, enabling unauthorized file creation and potential code injection. The vulnerability requires high attack complexity (AC:H) but no authentication or user interaction, affecting any Java application using vulnerable Junrar versions to process untrusted RAR files. Vendor-released patch: version 7.5.10.
Path traversal in junrar (the open source Java RAR archive library) prior to version 7.6.1 lets an attacker-supplied RAR archive cause LocalFolderExtractor to create directories outside the intended extraction root. The flaw exists because createFile() validates only the final canonical file path while makeFile() creates intermediate path segments with unchecked mkdir() calls, so a crafted entry whose final path resolves inside the destination can still spawn directories elsewhere - a specificity that is why the assessed vector carries AC:H. Impact is confined to directory creation and file-versus-directory squatting that can make later security-sensitive writes fail; there is no arbitrary file-content write and no confidentiality loss, unauthenticated remote attackers are the relevant threat model only when a host application extracts untrusted archives through this specific extractor, and no public exploit code has been identified at time of analysis. This is a genuinely low-priority issue, and the vendor's CVSS of 3.7 reflects that honestly rather than inflating it.
Junrar versions prior to 7.5.8 contain a path traversal vulnerability in LocalFolderExtractor that allows attackers to write arbitrary files to the filesystem when processing malicious RAR archives on Linux/Unix systems. Public exploit code exists for this vulnerability, which can facilitate remote code execution through file overwrite attacks such as modifying shell profiles or cron jobs. Users should upgrade to version 7.5.8 or later to remediate this issue.
Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.